Issue No.02 - February (2012 vol.61)
SangKyun Yun , Yonsei University, Wonju
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/TC.2010.273
This paper proposes a state encoding scheme called a covered state encoding for the efficient TCAM-based implementation of the Aho-Corasick multipattern matching algorithm, which is widely used in network intrusion detection systems. Since the information of failure transitions of the Aho-Corasick Nondeterministic Finite Automata (NFA) is implicitly captured in the covered state encoding and the failure transition entries can be completely eliminated, the Aho-Corasick NFA can be implemented on a TCAM with smaller number of entries than other schemes. We also propose constructing the modified Aho-Corasick NFA for multicharacter processing, which can be implemented on a TCAM using the covered state encoding. The implementation of modified Aho-Corasick NFA using the covered state encoding is also superior to other schemes in both TCAM memory requirement and lookup speed.
String matching, multipattern matching, TCAM, intrusion detection system, Aho-Corasick algorithm.
SangKyun Yun, "An Efficient TCAM-Based Implementation of Multipattern Matching Using Covered State Encoding", IEEE Transactions on Computers, vol.61, no. 2, pp. 213-221, February 2012, doi:10.1109/TC.2010.273